Application performance monitoring and management platform with anomalous flowlet resolution

Abstract

An application and network analytics platform can capture telemetry from servers and network devices operating within a network. The application and network analytics platform can determine an application dependency map (ADM) for an application executing in the network. Using the ADM, the application and network analytics platform can resolve flows into flowlets of various granularities, and determine baseline metrics for the flowlets. The baseline metrics can include transmission times, processing times, and/or data sizes for the flowlets. The application and network analytics platform can compare new flowlets against the baselines to assess availability, load, latency, and other performance metrics for the application. In some implementations, the application and network analytics platform can automate remediation of unavailability, load, latency, and other application performance issues.

The invention claimed is: 
     
       1. A method comprising:
 electing a cluster coordinator for a cluster, the cluster being a host-process pairing of nodes with a similarity threshold of one or more feature vectors associated with the nodes; 
 processing telemetry data for a plurality of flows associated with a set of devices in a network, the telemetry data received from a sensor registered by the cluster coordinator; 
 generating an application dependency map based on the processed telemetry data, the application dependency map indicating interconnectivities or dependencies of a plurality of flowlets of a flow from the plurality of flows, each flowlet of the plurality of flowlets comprising a sub-flow of the flow; 
 determining a baseline metric for a first flowlet of the plurality of flowlets; 
 determining, based on additional telemetry data associated with a second flowlet, a corresponding metric for the second flowlet; and 
 determining an anomalous flowlet based on a comparison of the baseline metric for the first flowlet and the corresponding metric for the second flowlet. 
 
     
     
       2. The method of  claim 1 , further comprising:
 determining that the anomalous flowlet was processed by a first device on the network and a second device on the network; and 
 based on the determining that the anomalous flowlet was processed by the first device and the second device, migrating the first device from a first location to a second location, wherein the migrating reduces a distance between the first device and a third location of the second device, the second location being different than the third location. 
 
     
     
       3. The method of  claim 1 , further comprising:
 determining a plurality of nodes of the application dependency map based on server and process features; 
 determining a plurality of edges of the application dependency map based on flow information in the telemetry data, wherein the flow information is associated with one or more flows between nodes of the plurality of nodes; 
 determining a first feature vector for a first node of the plurality of nodes; and 
 determining the cluster comprising the first node and a second node of the plurality of nodes of the application dependency map, the cluster being determined based on the similarity threshold between the first feature vector and a second feature vector of the second node. 
 
     
     
       4. The method of  claim 1 , further comprising:
 tracing one or more sub-requests and sub-responses to one or more servers on the network; and 
 determining the first flowlet based on the tracing. 
 
     
     
       5. The method of  claim 1 , further comprising:
 tracing the flow from a first device on the network to a second device on the network; and 
 determining the first flowlet based on the tracing. 
 
     
     
       6. The method of  claim 1 , wherein the baseline metric comprises a sum including a first time for transmitting the first flowlet to a network device and a second time for processing the first flowlet by the network device. 
     
     
       7. The method of  claim 1 , wherein the baseline metric comprises at least one of a first time for a first device to generate a sub-request to a second device on the network, a second time for transmitting the sub-request from the first device to the second device, a third time for processing the sub-request by the second device, a fourth time for generating a sub-response by the second device, or a fifth time for transmitting the sub-response from the second device to the first device. 
     
     
       8. A system comprising:
 one or more processors; and 
 memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 elect a cluster coordinator for a cluster, the cluster being a host-process pairing of nodes with a similarity threshold of one or more feature vectors associated with the nodes; 
 process telemetry data for a plurality of flows associated with a set of devices in a network, the telemetry data received from a sensor registered by the cluster coordinator; 
 generating an application dependency map based on the processed telemetry data, the application dependency map indicating interconnectivities or dependencies of a plurality of flowlets of a flow from the plurality of flows, each flowlet of the plurality of flowlets comprising a sub-flow of the flow; 
 determine a baseline metric for a first flowlet of the plurality of flowlets; 
 determine, based on additional telemetry data associated with a second flowlet, a corresponding metric for the second flowlet; and 
 determine an anomalous flowlet based on a comparison of the baseline metric for the first flowlet and the corresponding metric for the second flowlet. 
 
 
     
     
       9. The system of  claim 8 , the memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 determine that the anomalous flowlet was processed by a first device on the network and a second device on the network; and 
 based on the determining that the anomalous flowlet was processed by the first device and the second device, migrate the first device from a first location to a second location, wherein the migrating reduces a distance between the first device and a third location of the second device, the second location being different than the third location. 
 
     
     
       10. The system of  claim 8 , the memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 determine a plurality of nodes of the application dependency map based on server and process features; 
 determine a plurality of edges of the application dependency map based on flow information in the telemetry data, wherein the flow information is associated with one or more flows between nodes of the plurality of nodes; 
 determine a first feature vector for a first node of the plurality of nodes; and 
 determine the cluster comprising the first node and a second node of the plurality of nodes of the application dependency map, the cluster being determined based on the similarity threshold between the first feature vector and a second feature vector of the second node. 
 
     
     
       11. The system of  claim 8 , the memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 trace one or more sub-requests and sub-responses to one or more servers on the network; and 
 determine the first flowlet of the plurality of flowlets based on the tracing. 
 
     
     
       12. The system of  claim 8 , the memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 trace the flow from a first device on the network to a second device on the network; and 
 determine the first flowlet of the plurality of flowlets based on the tracing. 
 
     
     
       13. The system of  claim 8 , wherein the baseline metric comprises a sum including a first time for transmitting the first flowlet to a network device and a second time for processing the first flowlet by the network device. 
     
     
       14. The system of  claim 8 , wherein the baseline metric comprises at least one of a first time for a first device to generate a sub-request to a second device on the network, a second time for transmitting the sub-request from the first device to the second device, a third time for processing the sub-request by the second device, a fourth time for generating a sub-response by the second device, or a fifth time for transmitting the sub-response from the second device to the first device. 
     
     
       15. The system of  claim 8 , the memory having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 based on the anomalous flowlet, determine a condition associated with at least one of an application performance or a network performance. 
 
     
     
       16. At least one non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:
 elect a cluster coordinator for a cluster, the cluster being a host-process pairing of nodes with a similarity threshold of one or more feature vectors associated with the nodes; 
 process telemetry data for a plurality of flows associated with a set of devices in a network, the telemetry data received from a sensor registered by the cluster coordinator; 
 generating an application dependency map based on the processed telemetry data, the application dependency map indicating interconnectivities or dependencies of a plurality of flowlets of a flow from the plurality of flows, each flowlet of the plurality of flowlets comprising a sub-flow of the flow; 
 determine a baseline metric for a first flowlet of the plurality of flowlets; 
 determine, based on additional telemetry data associated with a second flowlet, a corresponding metric for the second flowlet; and 
 determine an anomalous flowlet based on a comparison of the baseline metric for the first flowlet and the corresponding metric for the second flowlet. 
 
     
     
       17. The at least one non-transitory computer-readable medium of  claim 16 , having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 determine that the anomalous flowlet was processed by a first server on the network and a second server on the network; and 
 based on the determining that the anomalous flowlet was processed by the first server and the second server, migrate the first server from a first location to a second location, wherein the migrating reduces a distance between the first server and a third location of the second server, the second location being different than the third location. 
 
     
     
       18. The at least one non-transitory computer-readable medium of  claim 16 , having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 determine a plurality of nodes of the application dependency map based on concatenated server and process features; 
 determine a plurality of edges of the application dependency map based on flow information in the telemetry data, wherein the flow information is indicative of one or more flows between nodes of the plurality of nodes; 
 determine a first feature vector for a first node of the plurality of nodes; and 
 determine the cluster comprising the first node and a second node of the plurality of nodes of the application dependency map, the cluster being determined based on the similarity threshold between the first feature vector and a second feature vector of the second node. 
 
     
     
       19. The at least one non-transitory computer-readable medium of  claim 16 , having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 trace one or more sub-requests and sub-responses to one or more servers on the network; and 
 determine the first flowlet of the plurality of flowlets based on the tracing. 
 
     
     
       20. The at least one non-transitory computer-readable medium of  claim 16 , having stored thereon instructions which, when executed by the one or more processors, cause the one or more processors to:
 trace the flow from a first device on the network to a second device on the network; and 
 determine the first flowlet of the plurality of flowlets based on the tracing.